23b137ce3bf552461beac7baf3a449a620010feac5cf69a1864e40b5efa04c2d

Analysis

max time kernel
40s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-10-2022 22:16

Target

file.exe
Size

3.6MB
MD5

16071179683d1f84d63728f7a4c03167
SHA1

179bb2c4aff7752e8082c84b585212a2ab82124f
SHA256

23b137ce3bf552461beac7baf3a449a620010feac5cf69a1864e40b5efa04c2d
SHA512

1465fe553b9f105195a3de21e71c02df5e0dc23d33f8d8751afedee34becfc7351dc81b7054249c9b402673b59c528abccea9635da407b05bc05ecbd78e5958d
SSDEEP

49152:zQYDduXQyUijUpPL6yukdjTbi6Q3/akOAA49SOt3wueGyiopbsb1GZHunfTrLh:8q2PUiApskdrUPakmO1wue3sbAOnbrLh

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

file.exe

pid process

1488 file.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

file.exe

description pid process

Token: SeDebugPrivilege 1488 file.exe

pid	process
1488	file.exe

description	pid	process
Token: SeDebugPrivilege	1488	file.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

file.exe

description	pid	process	target process
PID 1488 wrote to memory of 1800	1488	file.exe	MSBuild.exe
PID 1488 wrote to memory of 1800	1488	file.exe	MSBuild.exe
PID 1488 wrote to memory of 1800	1488	file.exe	MSBuild.exe
PID 1488 wrote to memory of 1800	1488	file.exe	MSBuild.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe"
2⤵
PID:1800

memory/1488-54-0x0000000000990000-0x0000000000D28000-memory.dmp

Filesize
3.6MB

Download
memory/1488-55-0x00000000003D0000-0x0000000000436000-memory.dmp

Filesize
408KB

Download